Senior Cybersecurity Penetration Tester (f/m/div.)

BOSC; Aveiro; Presencial; EUR 60.000 - 90.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Health insurance

Training opportunities

Career progression

Discounts on Bosch products

On-site medical facilities

Sports and health activities

Descripción de la vacante

Bosch Group in Aveiro, Portugal seeks a Senior Cybersecurity Penetration Tester to identify, assess, and mitigate security vulnerabilities across its digital ecosystem. You will lead complex evaluations of web applications, APIs, cloud-native environments, and backend architectures to help engineering teams build secure-by-design solutions.

Responsibilities include planning comprehensive tests, collaborating with DevOps during design, performing detailed analyses, and producing actionable

Formación

• 3+ years of hands-on security assessment experience focusing on web apps, APIs, and cloud.
• Degree in CS/Cybersecurity or equivalent practical security experience.
• Proficient in English for technical reporting and stakeholder communication.

Responsabilidades

• Plan, scope, and execute penetrations on web apps, APIs, and cloud environments.
• Lead threat modeling and architecture reviews with dev/DevOps teams.
• Perform deep vulnerability analyses and report findings with remediation guidance.
• Develop testing scripts and integrate AI-assisted security testing workflows.
• Deliver high-quality technical reports translating risks to business impact.

Conocimientos

English fluency

Security testing

Threat modeling

Cloud security

Educación

Degree in CS/Cybersecurity or equivalent

Herramientas

Burp Suite Pro

OWASP ZAP

Postman

Python scripting

Bash scripting

Docker

Kubernetes

Descripción del empleo

Senior Cybersecurity Penetration Tester (f/m/div.)

• Full-time
• Legal Entity: Home Comfort

The Bosch Group has more than 400 000 employees around the world, present in 60 countries, and we are proud to impact people’s lives and to work towards a more sustainable future.

In the city of Aveiro, Bosch has one of its biggest production sites for Bosch Home Comfort division, as well as a Research and Development Center for new and improved heating solutions for the residential segment. With more than 1400 employees, focused on innovation, sustainability and collaboration, Bosch Aveiro joins together experts in diverse areas, from mechanical engineering to connectivity and software solutions, as well as industrialization and quality.

At Bosch, we shape the future by inventing high-quality technologies and services that spark enthusiasm and enrich people’s lives. Our promise to our associates is rock-solid: we grow together, we enjoy our work, and we inspire each other. Join in and feel the difference in mindsets, cultures, generations, identities and perspectives. Everyone should bring their authenticity and work together respectfully. Bosch is an employer that values diversity and equal opportunities. We welcome applications from people with disabilities and we can provide reasonable accommodations during the recruitment process and in the performance of professional activity. By including everyone and ensuring equal opportunities we unleash our full potential.

As a Senior Penetration Tester, you will play a central role in identifying, assessing, and mitigating security vulnerabilities across our digital ecosystem. You will lead complex technical evaluations spanning modern web applications, backend architectures, APIs, and cloud-native environments, helping engineering teams build resilient, secure-by-design solutions.

Your contribution to something big:

• Drive Offensive Security: Plan, scope, and execute comprehensive penetration tests on modern web applications, backend microservices, REST/GraphQL APIs, and cloud-native environments (AWS, Azure, or GCP).
• Threat Modeling & Architecture Review: Collaborate closely with development and DevOps teams early in the design phase to conduct threat modeling and review architectures, ensuring security is baked in from day one.
• Vulnerability Analysis & Exploitation: Perform deep-dive manual and automated vulnerability analyses, uncovering complex flaws like business logic bypasses, authorization failures, and server-side request forgeries.
• Technical Reporting & Remediation Guidance: Author high-quality, actionable technical reports that translate complex technical risks into clear business impacts, providing pragmatic remediation guidance to our engineering squads.
• Tooling & Innovation: Develop custom testing scripts and explore cutting-edge offensive workflows, including integrating AI-assisted security testing and LLM-augmented vulnerability analysis to maximize speed and coverage.

What distinguishes you:

Education

• Degree in Computer Science, Cybersecurity, IT, Software Engineering, or equivalent practical experience in offensive security.

Experience

• Hands-on experience (ideally 3+ years) conducting technical security assessments, with a strong focus on web applications, APIs, and cloud infrastructure.

Know how

• Offensive Security Expertise: In-depth knowledge of backend technologies, secure protocols, and security standards (e.g., OWASP Top 10, ASVS, WSTG, OAuth 2.0).
• Cloud & Modern Tech: Solid familiarity with assessing cloud environments (AWS, Azure, or GCP), IAM configurations, container security (Docker, Kubernetes), and microservices.
• Tools & Scripting: High proficiency with industry-standard offensive tools (e.g., Burp Suite Pro, OWASP ZAP, Postman) combined with scripting skills (e.g., Python, Bash) to automate testing workflows.

Languages

• Excellent communication skills with fluency in English (written and spoken) to effectively present findings to both technical teams and business stakeholders.

Working Style and Methods

An analytical and structured problem-solver who enjoys working collaboratively across cross-functional teams to build collective security resilience.

Personality

A curious, continuous learner with a passion for offensive security, exploring new technologies, and a strong drive to mentor and share knowledge with others.

We also welcome (Preferred / Nice-to-have):

• Enthusiastic interest or experience in AI-driven offensive workflows (e.g., automated payload generation, LLM security evaluations).
• Industry certifications such as OSCP, OSWE, OSCE, CRTP, GWAPT, GPEN, or cloud-specific security certifications.
• Experience with source code reviews (SAST) in common modern languages (Java, Python, Go, TypeScript).

Exchange with colleagues around the world

Health insurance and medical office on site (general surgeon, psychology, physiotherapy, general clinic)

Training opportunities (p.e., technical training, foreign languages training) & certifications

Opportunities for career progression and continuous professional development

Access to great discounts in partnerships and Bosch products

Sports and health related activities

Success stories don´t just happen. They are made...